@mastra/factory 0.0.0 → 0.1.0-alpha.3

package/dist/routes/tenant-credentials.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Per-tenant credential store for model resolution (deployed mode).
+ *
+ * The SDK's `resolveModel` asks the registered `CredentialStoreProvider` for a
+ * store synchronously, so this module keeps a small per-tenant **snapshot** of
+ * resolved credentials (user rows over org rows) hydrated from the
+ * `model-credentials` domain. The snapshot serves the gateway's synchronous
+ * path-selection reads (`get` / `getStoredApiKey`); the fetch-time
+ * `getApiKey` is authoritative — it re-resolves against the domain and
+ * refreshes expired OAuth tokens under the domain's row lock, so a slightly
+ * stale snapshot can never send an expired token upstream.
+ *
+ * Snapshots are primed per request by `createTenantCredentialPrimer` (mounted
+ * after the web auth gate) so the first model call of a request already sees
+ * the caller's credentials. This store explicitly disables the SDK's
+ * environment fallback so server-shell credentials never leak into tenants.
+ */
+import type { CredentialTenant as SdkCredentialTenant } from '@mastra/code-sdk/agents/credential-resolver';
+import type { AuthCredential, CredentialStore } from '@mastra/code-sdk/auth/types';
+import type { MiddlewareHandler } from 'hono';
+import type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';
+import type { RouteAuth } from './route.js';
+export declare class TenantCredentialStore implements CredentialStore {
+    #private;
+    readonly allowEnvironmentFallback = false;
+    constructor(orgId: string, userId: string, credentials: ModelCredentialsStorage | undefined);
+    /** Hydrate the snapshot when stale; coalesces concurrent callers. */
+    ensureFresh(now?: number): Promise<void>;
+    /** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */
+    reload(): void;
+    get(provider: string): AuthCredential | undefined;
+    getStoredApiKey(provider: string): string | undefined;
+    /**
+     * Authoritative fetch-time resolution: re-reads the domain (user > org) and
+     * refreshes expired OAuth tokens under the domain's row lock. Mirrors
+     * `AuthStorage.getApiKey` semantics: `undefined` on missing credential or
+     * failed refresh (caller surfaces a re-login error).
+     */
+    getApiKey(provider: string): Promise<string | undefined>;
+}
+/**
+ * Register the web tenant credential store provider with the SDK. Called by
+ * the factory after storage init with the `model-credentials` domain handle;
+ * from then on `resolveModel` uses per-tenant credentials and the SDK skips
+ * the `loadStoredApiKeysIntoEnv` env side-channel.
+ */
+export declare function registerTenantCredentialResolver(credentials: ModelCredentialsStorage): void;
+/** Test hook: clear registration and cached tenant snapshots. */
+export declare function resetTenantCredentialResolverForTests(): void;
+/**
+ * Drop cached snapshots after a credential write so the change is visible to
+ * the next model call immediately instead of after the snapshot TTL. An org
+ * write affects every member's resolved view, so all stores under the org are
+ * invalidated; a user write only drops that user's store.
+ */
+export declare function invalidateTenantCredentialSnapshots(tenant: {
+    orgId: string;
+    userId?: string;
+}): void;
+/**
+ * Middleware mounted after the web auth gate: primes the caller's credential
+ * snapshot so the request's first model call sees their credentials without an
+ * async seam in model resolution. Cheap when fresh (TTL check), best-effort
+ * when not — a failed hydrate falls back to env vars, never blocks a request.
+ */
+export declare function primeTenantCredentials({ tenant, credentials, }: {
+    tenant: SdkCredentialTenant;
+    credentials: ModelCredentialsStorage;
+}): Promise<void>;
+export declare function createTenantCredentialPrimer({ auth, credentials, }: {
+    auth: RouteAuth;
+    credentials: ModelCredentialsStorage;
+}): MiddlewareHandler;
+//# sourceMappingURL=tenant-credentials.d.ts.map

package/dist/routes/tenant-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-credentials.d.ts","sourceRoot":"","sources":["../../src/routes/tenant-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,IAAI,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAG3G,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAG9C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEtF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAQ5C,qBAAa,qBAAsB,YAAW,eAAe;;IAC3D,QAAQ,CAAC,wBAAwB,SAAS;gBAQ9B,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,uBAAuB,GAAG,SAAS;IAM3F,qEAAqE;IAC/D,WAAW,CAAC,GAAG,SAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBlD,kFAAkF;IAClF,MAAM,IAAI,IAAI;IAMd,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIjD,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrD;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CA+C/D;AAmBD;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,uBAAuB,GAAG,IAAI,CAE3F;AAED,iEAAiE;AACjE,wBAAgB,qCAAqC,IAAI,IAAI,CAG5D;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQpG;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,MAAM,EACN,WAAW,GACZ,EAAE;IACD,MAAM,EAAE,mBAAmB,CAAC;IAC5B,WAAW,EAAE,uBAAuB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;AAED,wBAAgB,4BAA4B,CAAC,EAC3C,IAAI,EACJ,WAAW,GACZ,EAAE;IACD,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,uBAAuB,CAAC;CACtC,GAAG,iBAAiB,CAYpB"}

package/dist/routes/tenant-credentials.js

@@ -0,0 +1,181 @@
+// src/routes/tenant-credentials.ts
+import { setCredentialStoreProvider } from "@mastra/code-sdk/agents/credential-resolver";
+import { getOAuthProvider } from "@mastra/code-sdk/auth/storage";
+
+// src/storage/domains/credentials/base.ts
+import { FactoryStorageDomain, UniqueViolationError } from "@mastra/core/storage";
+function isOAuthCredentialExpired(credential, now = Date.now()) {
+  return now >= credential.expires;
+}
+
+// src/routes/provider-credentials.ts
+async function getTenantCredentialsStorage(credentials) {
+  if (!credentials) return void 0;
+  try {
+    await credentials.ensureReady();
+  } catch {
+    return void 0;
+  }
+  return credentials;
+}
+function tenantOrgId(tenant) {
+  return tenant.orgId ?? `user:${tenant.userId}`;
+}
+
+// src/routes/tenant-credentials.ts
+var SNAPSHOT_TTL_MS = 15e3;
+var MAX_CACHED_TENANTS = 1e3;
+var TenantCredentialStore = class {
+  allowEnvironmentFallback = false;
+  #orgId;
+  #userId;
+  #credentials;
+  #snapshot = /* @__PURE__ */ new Map();
+  #fetchedAt = 0;
+  #hydrating;
+  constructor(orgId, userId, credentials) {
+    this.#orgId = orgId;
+    this.#userId = userId;
+    this.#credentials = credentials;
+  }
+  /** Hydrate the snapshot when stale; coalesces concurrent callers. */
+  async ensureFresh(now = Date.now()) {
+    if (now - this.#fetchedAt < SNAPSHOT_TTL_MS) return;
+    this.#hydrating ??= this.#hydrate().finally(() => {
+      this.#hydrating = void 0;
+    });
+    await this.#hydrating;
+  }
+  async #hydrate() {
+    const storage = await getTenantCredentialsStorage(this.#credentials);
+    if (!storage) return;
+    const records = await storage.listCredentials(this.#orgId, this.#userId);
+    const next = /* @__PURE__ */ new Map();
+    for (const record of records.filter((r) => r.scope === "org")) {
+      next.set(record.provider, record.credential);
+    }
+    for (const record of records.filter((r) => r.scope === "user")) {
+      next.set(record.provider, record.credential);
+    }
+    this.#snapshot = next;
+    this.#fetchedAt = Date.now();
+  }
+  /** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */
+  reload() {
+    if (Date.now() - this.#fetchedAt >= SNAPSHOT_TTL_MS) {
+      void this.ensureFresh().catch(() => {
+      });
+    }
+  }
+  get(provider) {
+    return this.#snapshot.get(provider);
+  }
+  getStoredApiKey(provider) {
+    const cred = this.#snapshot.get(provider);
+    return cred?.type === "api_key" ? cred.key : void 0;
+  }
+  /**
+   * Authoritative fetch-time resolution: re-reads the domain (user > org) and
+   * refreshes expired OAuth tokens under the domain's row lock. Mirrors
+   * `AuthStorage.getApiKey` semantics: `undefined` on missing credential or
+   * failed refresh (caller surfaces a re-login error).
+   */
+  async getApiKey(provider) {
+    const storage = await getTenantCredentialsStorage(this.#credentials);
+    if (!storage) {
+      const cred = this.#snapshot.get(provider);
+      if (cred?.type === "api_key") return cred.key;
+      if (cred?.type === "oauth" && !isOAuthCredentialExpired(cred)) {
+        return getOAuthProvider(provider)?.getApiKey(cred);
+      }
+      return void 0;
+    }
+    const resolved = await storage.resolveCredential(this.#orgId, this.#userId, provider);
+    if (!resolved) {
+      this.#snapshot.delete(provider);
+      return void 0;
+    }
+    this.#snapshot.set(provider, resolved.credential);
+    if (resolved.credential.type === "api_key") {
+      return resolved.credential.key;
+    }
+    const oauthProvider = getOAuthProvider(provider);
+    if (!oauthProvider) return void 0;
+    if (!isOAuthCredentialExpired(resolved.credential)) {
+      return oauthProvider.getApiKey(resolved.credential);
+    }
+    const rowTenant = resolved.scope === "user" ? { orgId: this.#orgId, userId: this.#userId } : { orgId: this.#orgId };
+    try {
+      const refreshed = await storage.refreshOAuth(rowTenant, provider, async (current) => ({
+        type: "oauth",
+        ...await oauthProvider.refreshToken(current)
+      }));
+      if (!refreshed) return void 0;
+      this.#snapshot.set(provider, refreshed);
+      return oauthProvider.getApiKey(refreshed);
+    } catch {
+      return void 0;
+    }
+  }
+};
+var tenantStores = /* @__PURE__ */ new Map();
+function storeFor(tenant, credentials) {
+  const orgId = tenantOrgId(tenant);
+  const key = `${orgId}\0${tenant.userId}`;
+  let store = tenantStores.get(key);
+  if (!store) {
+    if (tenantStores.size >= MAX_CACHED_TENANTS) {
+      const oldest = tenantStores.keys().next().value;
+      if (oldest !== void 0) tenantStores.delete(oldest);
+    }
+    store = new TenantCredentialStore(orgId, tenant.userId, credentials);
+    tenantStores.set(key, store);
+  }
+  return store;
+}
+function registerTenantCredentialResolver(credentials) {
+  setCredentialStoreProvider((tenant) => storeFor(tenant, credentials));
+}
+function resetTenantCredentialResolverForTests() {
+  setCredentialStoreProvider(void 0);
+  tenantStores.clear();
+}
+function invalidateTenantCredentialSnapshots(tenant) {
+  if (tenant.userId) {
+    tenantStores.delete(`${tenant.orgId}\0${tenant.userId}`);
+    return;
+  }
+  for (const key of tenantStores.keys()) {
+    if (key.startsWith(`${tenant.orgId}\0`)) tenantStores.delete(key);
+  }
+}
+async function primeTenantCredentials({
+  tenant,
+  credentials
+}) {
+  await storeFor(tenant, credentials).ensureFresh();
+}
+function createTenantCredentialPrimer({
+  auth,
+  credentials
+}) {
+  return async (c, next) => {
+    const tenant = auth.tenant(c);
+    if (tenant) {
+      try {
+        await storeFor(tenant, credentials).ensureFresh();
+      } catch {
+      }
+    }
+    await next();
+  };
+}
+export {
+  TenantCredentialStore,
+  createTenantCredentialPrimer,
+  invalidateTenantCredentialSnapshots,
+  primeTenantCredentials,
+  registerTenantCredentialResolver,
+  resetTenantCredentialResolverForTests
+};
+//# sourceMappingURL=tenant-credentials.js.map

package/dist/routes/tenant-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/routes/tenant-credentials.ts","../../src/storage/domains/credentials/base.ts","../../src/routes/provider-credentials.ts"],"sourcesContent":["/**\n * Per-tenant credential store for model resolution (deployed mode).\n *\n * The SDK's `resolveModel` asks the registered `CredentialStoreProvider` for a\n * store synchronously, so this module keeps a small per-tenant **snapshot** of\n * resolved credentials (user rows over org rows) hydrated from the\n * `model-credentials` domain. The snapshot serves the gateway's synchronous\n * path-selection reads (`get` / `getStoredApiKey`); the fetch-time\n * `getApiKey` is authoritative — it re-resolves against the domain and\n * refreshes expired OAuth tokens under the domain's row lock, so a slightly\n * stale snapshot can never send an expired token upstream.\n *\n * Snapshots are primed per request by `createTenantCredentialPrimer` (mounted\n * after the web auth gate) so the first model call of a request already sees\n * the caller's credentials. This store explicitly disables the SDK's\n * environment fallback so server-shell credentials never leak into tenants.\n */\n\nimport type { CredentialTenant as SdkCredentialTenant } from '@mastra/code-sdk/agents/credential-resolver';\nimport { setCredentialStoreProvider } from '@mastra/code-sdk/agents/credential-resolver';\nimport { getOAuthProvider } from '@mastra/code-sdk/auth/storage';\nimport type { AuthCredential, CredentialStore } from '@mastra/code-sdk/auth/types';\nimport type { MiddlewareHandler } from 'hono';\n\nimport { isOAuthCredentialExpired } from '../storage/domains/credentials/base.js';\nimport type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport { getTenantCredentialsStorage, tenantOrgId } from './provider-credentials.js';\nimport type { RouteAuth } from './route.js';\n\n/** How long a hydrated snapshot is considered fresh. */\nconst SNAPSHOT_TTL_MS = 15_000;\n\n/** Cap on cached tenant stores; oldest-inserted evicted beyond this. */\nconst MAX_CACHED_TENANTS = 1000;\n\nexport class TenantCredentialStore implements CredentialStore {\n  readonly allowEnvironmentFallback = false;\n  readonly #orgId: string;\n  readonly #userId: string;\n  readonly #credentials: ModelCredentialsStorage | undefined;\n  #snapshot = new Map<string, AuthCredential>();\n  #fetchedAt = 0;\n  #hydrating: Promise<void> | undefined;\n\n  constructor(orgId: string, userId: string, credentials: ModelCredentialsStorage | undefined) {\n    this.#orgId = orgId;\n    this.#userId = userId;\n    this.#credentials = credentials;\n  }\n\n  /** Hydrate the snapshot when stale; coalesces concurrent callers. */\n  async ensureFresh(now = Date.now()): Promise<void> {\n    if (now - this.#fetchedAt < SNAPSHOT_TTL_MS) return;\n    this.#hydrating ??= this.#hydrate().finally(() => {\n      this.#hydrating = undefined;\n    });\n    await this.#hydrating;\n  }\n\n  async #hydrate(): Promise<void> {\n    const storage = await getTenantCredentialsStorage(this.#credentials);\n    if (!storage) return; // Keep the last tenant-scoped snapshot.\n    const records = await storage.listCredentials(this.#orgId, this.#userId);\n    const next = new Map<string, AuthCredential>();\n    // Org rows first so user rows overwrite them (user > org precedence).\n    for (const record of records.filter(r => r.scope === 'org')) {\n      next.set(record.provider, record.credential);\n    }\n    for (const record of records.filter(r => r.scope === 'user')) {\n      next.set(record.provider, record.credential);\n    }\n    this.#snapshot = next;\n    this.#fetchedAt = Date.now();\n  }\n\n  /** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */\n  reload(): void {\n    if (Date.now() - this.#fetchedAt >= SNAPSHOT_TTL_MS) {\n      void this.ensureFresh().catch(() => {});\n    }\n  }\n\n  get(provider: string): AuthCredential | undefined {\n    return this.#snapshot.get(provider);\n  }\n\n  getStoredApiKey(provider: string): string | undefined {\n    const cred = this.#snapshot.get(provider);\n    return cred?.type === 'api_key' ? cred.key : undefined;\n  }\n\n  /**\n   * Authoritative fetch-time resolution: re-reads the domain (user > org) and\n   * refreshes expired OAuth tokens under the domain's row lock. Mirrors\n   * `AuthStorage.getApiKey` semantics: `undefined` on missing credential or\n   * failed refresh (caller surfaces a re-login error).\n   */\n  async getApiKey(provider: string): Promise<string | undefined> {\n    const storage = await getTenantCredentialsStorage(this.#credentials);\n    if (!storage) {\n      // Domain unavailable: best effort from the snapshot; expired OAuth\n      // tokens cannot be refreshed without the domain's lock.\n      const cred = this.#snapshot.get(provider);\n      if (cred?.type === 'api_key') return cred.key;\n      if (cred?.type === 'oauth' && !isOAuthCredentialExpired(cred)) {\n        return getOAuthProvider(provider)?.getApiKey(cred);\n      }\n      return undefined;\n    }\n\n    const resolved = await storage.resolveCredential(this.#orgId, this.#userId, provider);\n    if (!resolved) {\n      this.#snapshot.delete(provider);\n      return undefined;\n    }\n    this.#snapshot.set(provider, resolved.credential);\n\n    if (resolved.credential.type === 'api_key') {\n      return resolved.credential.key;\n    }\n\n    const oauthProvider = getOAuthProvider(provider);\n    if (!oauthProvider) return undefined;\n\n    if (!isOAuthCredentialExpired(resolved.credential)) {\n      return oauthProvider.getApiKey(resolved.credential);\n    }\n\n    // Refresh at the scope the credential actually lives at (OAuth rows are\n    // user-scoped by policy, but resolve defensively from the record).\n    const rowTenant = resolved.scope === 'user' ? { orgId: this.#orgId, userId: this.#userId } : { orgId: this.#orgId };\n    try {\n      const refreshed = await storage.refreshOAuth(rowTenant, provider, async current => ({\n        type: 'oauth' as const,\n        ...(await oauthProvider.refreshToken(current)),\n      }));\n      if (!refreshed) return undefined;\n      this.#snapshot.set(provider, refreshed);\n      return oauthProvider.getApiKey(refreshed);\n    } catch {\n      // Refresh failed — user needs to re-login (same posture as AuthStorage).\n      return undefined;\n    }\n  }\n}\n\nconst tenantStores = new Map<string, TenantCredentialStore>();\n\nfunction storeFor(tenant: SdkCredentialTenant, credentials: ModelCredentialsStorage): TenantCredentialStore {\n  const orgId = tenantOrgId(tenant);\n  const key = `${orgId}\\u0000${tenant.userId}`;\n  let store = tenantStores.get(key);\n  if (!store) {\n    if (tenantStores.size >= MAX_CACHED_TENANTS) {\n      const oldest = tenantStores.keys().next().value;\n      if (oldest !== undefined) tenantStores.delete(oldest);\n    }\n    store = new TenantCredentialStore(orgId, tenant.userId, credentials);\n    tenantStores.set(key, store);\n  }\n  return store;\n}\n\n/**\n * Register the web tenant credential store provider with the SDK. Called by\n * the factory after storage init with the `model-credentials` domain handle;\n * from then on `resolveModel` uses per-tenant credentials and the SDK skips\n * the `loadStoredApiKeysIntoEnv` env side-channel.\n */\nexport function registerTenantCredentialResolver(credentials: ModelCredentialsStorage): void {\n  setCredentialStoreProvider(tenant => storeFor(tenant, credentials));\n}\n\n/** Test hook: clear registration and cached tenant snapshots. */\nexport function resetTenantCredentialResolverForTests(): void {\n  setCredentialStoreProvider(undefined);\n  tenantStores.clear();\n}\n\n/**\n * Drop cached snapshots after a credential write so the change is visible to\n * the next model call immediately instead of after the snapshot TTL. An org\n * write affects every member's resolved view, so all stores under the org are\n * invalidated; a user write only drops that user's store.\n */\nexport function invalidateTenantCredentialSnapshots(tenant: { orgId: string; userId?: string }): void {\n  if (tenant.userId) {\n    tenantStores.delete(`${tenant.orgId}\\u0000${tenant.userId}`);\n    return;\n  }\n  for (const key of tenantStores.keys()) {\n    if (key.startsWith(`${tenant.orgId}\\u0000`)) tenantStores.delete(key);\n  }\n}\n\n/**\n * Middleware mounted after the web auth gate: primes the caller's credential\n * snapshot so the request's first model call sees their credentials without an\n * async seam in model resolution. Cheap when fresh (TTL check), best-effort\n * when not — a failed hydrate falls back to env vars, never blocks a request.\n */\nexport async function primeTenantCredentials({\n  tenant,\n  credentials,\n}: {\n  tenant: SdkCredentialTenant;\n  credentials: ModelCredentialsStorage;\n}): Promise<void> {\n  await storeFor(tenant, credentials).ensureFresh();\n}\n\nexport function createTenantCredentialPrimer({\n  auth,\n  credentials,\n}: {\n  auth: RouteAuth;\n  credentials: ModelCredentialsStorage;\n}): MiddlewareHandler {\n  return async (c, next) => {\n    const tenant = auth.tenant(c);\n    if (tenant) {\n      try {\n        await storeFor(tenant, credentials).ensureFresh();\n      } catch {\n        // Fail open: model calls fall back to env credentials.\n      }\n    }\n    await next();\n  };\n}\n","/**\n * Model provider credentials domain — tenant-scoped OAuth tokens and API keys\n * for model providers (Anthropic/Claude Max, OpenAI Codex, GitHub Copilot,\n * xAI, plus plain API-key providers).\n *\n * Tenancy is two-level:\n * - **user-scoped** rows (`userId` present): personal plan OAuth tokens and\n *   personal API keys. OAuth plan tokens are ONLY ever user-scoped — they are\n *   personal subscriptions, and sharing one would bill/rate-limit a single\n *   account for the whole org.\n * - **org-scoped** rows (`userId` absent): shared API keys set by an org\n *   admin, inherited by every member.\n *\n * Resolution order at model-call time is user > org (the caller layers server\n * env vars underneath as a final fallback).\n *\n * Secrets posture: credentials are stored server-side only and never returned\n * to the client (same as `linear_connections.access_token`). Encryption at\n * rest is out of scope, matching the existing posture.\n *\n * The domain also owns `oauth_login_sessions`: pending web login flows\n * (paste-code PKCE verifiers, device-code poll state) persisted server-side so\n * any replica can complete or poll a flow started on another.\n */\n\nimport type { AuthCredential, OAuthCredential } from '@mastra/code-sdk/auth/types';\nimport { FactoryStorageDomain, UniqueViolationError } from '@mastra/core/storage';\nimport type { CollectionSchema, CollectionWhere, FactoryStorageOps } from '@mastra/core/storage';\n\n/** Owning tenant of a credential row. `userId` absent = org-scoped row. */\nexport interface CredentialTenant {\n  orgId: string;\n  userId?: string;\n}\n\n/** Which tenancy level a credential row lives at. */\nexport type CredentialScope = 'user' | 'org';\n\n/** One stored credential, annotated with its scope. */\nexport interface CredentialRecord {\n  provider: string;\n  scope: CredentialScope;\n  credential: AuthCredential;\n  updatedAt: Date;\n}\n\n/** Result of per-caller resolution: the winning credential and its scope. */\nexport interface ResolvedCredential {\n  provider: string;\n  scope: CredentialScope;\n  credential: AuthCredential;\n}\n\n/** Kind of pending web login flow a session row tracks. */\nexport type LoginSessionKind = 'paste-code' | 'device-code';\n\n/** One pending OAuth login flow, persisted so any replica can continue it. */\nexport interface LoginSessionRow {\n  sessionId: string;\n  orgId: string;\n  userId: string;\n  provider: string;\n  kind: LoginSessionKind;\n  /** Serialized flow state (PKCE verifier, device-code pending state, ...). */\n  pending: Record<string, unknown>;\n  expiresAt: Date;\n  /** Earliest time the next upstream poll is allowed (device-code flows). */\n  nextPollAt: Date | null;\n  createdAt: Date;\n}\n\nexport interface CreateLoginSessionInput {\n  sessionId: string;\n  orgId: string;\n  userId: string;\n  provider: string;\n  kind: LoginSessionKind;\n  pending: Record<string, unknown>;\n  expiresAt: Date;\n  nextPollAt?: Date | null;\n}\n\n/** Mirror of `AuthStorage.getApiKey()`'s expiry check. */\nexport function isOAuthCredentialExpired(credential: OAuthCredential, now = Date.now()): boolean {\n  return now >= credential.expires;\n}\n\n/** OAuth plan credentials are personal and must always have an owning user. */\nexport function assertCredentialScope(tenant: CredentialTenant, credential: AuthCredential): void {\n  if (credential.type === 'oauth' && !tenant.userId) {\n    throw new Error('OAuth credentials must be user-scoped');\n  }\n}\n\nexport const MODEL_CREDENTIALS_SCHEMA: CollectionSchema = {\n  name: 'model_provider_credentials',\n  columns: {\n    id: { type: 'uuid-pk' },\n    org_id: { type: 'text' },\n    user_id: { type: 'text', nullable: true },\n    provider: { type: 'text' },\n    type: { type: 'text' },\n    data: { type: 'json' },\n    created_at: { type: 'timestamp' },\n    updated_at: { type: 'timestamp' },\n  },\n  uniqueIndexes: [\n    // Scope is encoded in `user_id` nullability (NULL = org-scoped shared\n    // row), enforced by two partial unique indexes.\n    {\n      name: 'model_provider_credentials_user_unique',\n      columns: ['org_id', 'user_id', 'provider'],\n      whereNotNull: 'user_id',\n    },\n    { name: 'model_provider_credentials_org_unique', columns: ['org_id', 'provider'], whereNull: 'user_id' },\n  ],\n};\n\nexport const OAUTH_LOGIN_SESSIONS_SCHEMA: CollectionSchema = {\n  name: 'oauth_login_sessions',\n  columns: {\n    session_id: { type: 'text', primaryKey: true },\n    org_id: { type: 'text' },\n    user_id: { type: 'text' },\n    provider: { type: 'text' },\n    kind: { type: 'text' },\n    pending: { type: 'json' },\n    expires_at: { type: 'timestamp' },\n    next_poll_at: { type: 'timestamp', nullable: true },\n    created_at: { type: 'timestamp' },\n  },\n};\n\n/** Column shape of one `model_provider_credentials` row as returned by ops. */\ninterface CredentialDbRow extends Record<string, unknown> {\n  id: string;\n  provider: string;\n  user_id: string | null;\n  data: AuthCredential;\n  updated_at: Date;\n}\n\n/** Column shape of one `oauth_login_sessions` row as returned by ops. */\ninterface LoginSessionDbRow extends Record<string, unknown> {\n  session_id: string;\n  org_id: string;\n  user_id: string;\n  provider: string;\n  kind: LoginSessionKind;\n  pending: Record<string, unknown>;\n  expires_at: Date;\n  next_poll_at: Date | null;\n  created_at: Date;\n}\n\nfunction toSessionRow(db: LoginSessionDbRow): LoginSessionRow {\n  return {\n    sessionId: db.session_id,\n    orgId: db.org_id,\n    userId: db.user_id,\n    provider: db.provider,\n    kind: db.kind,\n    pending: db.pending,\n    expiresAt: db.expires_at,\n    nextPollAt: db.next_poll_at,\n    createdAt: db.created_at,\n  };\n}\n\n/** Filter selecting exactly the tenant's row for a provider (`null` = org row). */\nfunction tenantWhere(tenant: CredentialTenant, provider: string): CollectionWhere {\n  return { org_id: tenant.orgId, provider, user_id: tenant.userId ?? null };\n}\n\n/**\n * Model-credentials storage, written once against the generic\n * `FactoryStorageOps` surface. `refreshOAuth()` and `claimLoginSession()`\n * ride `updateAtomic` so concurrent replicas serialize instead of\n * invalidating each other's rotating tokens / double-claiming a flow.\n */\nexport class ModelCredentialsStorage extends FactoryStorageDomain {\n  constructor() {\n    super('model-credentials');\n  }\n\n  async init(): Promise<void> {\n    await this.ensureCollections([MODEL_CREDENTIALS_SCHEMA, OAUTH_LOGIN_SESSIONS_SCHEMA]);\n  }\n\n  async dangerouslyClearAll(): Promise<void> {\n    await this.ops.deleteMany('oauth_login_sessions', {});\n    await this.ops.deleteMany('model_provider_credentials', {});\n  }\n\n  get #db(): FactoryStorageOps {\n    return this.ops;\n  }\n\n  /** Read the tenant's credential for a provider at exactly that scope. */\n  async getCredential(tenant: CredentialTenant, provider: string): Promise<AuthCredential | undefined> {\n    const row = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', tenantWhere(tenant, provider));\n    return row?.data;\n  }\n\n  /** Upsert the tenant's credential (`created_at` is preserved on update). */\n  async setCredential(tenant: CredentialTenant, provider: string, credential: AuthCredential): Promise<void> {\n    assertCredentialScope(tenant, credential);\n    const where = tenantWhere(tenant, provider);\n    const update = async () =>\n      this.#db.updateMany('model_provider_credentials', where, {\n        type: credential.type,\n        data: credential,\n        updated_at: new Date(),\n      });\n\n    let lastError: unknown;\n    for (let attempt = 0; attempt < 2; attempt++) {\n      if ((await update()) > 0) return;\n\n      const now = new Date();\n      try {\n        await this.#db.insertOne<CredentialDbRow>('model_provider_credentials', {\n          org_id: tenant.orgId,\n          user_id: tenant.userId ?? null,\n          provider,\n          type: credential.type,\n          data: credential,\n          created_at: now,\n          updated_at: now,\n        });\n        return;\n      } catch (error) {\n        if (!(error instanceof UniqueViolationError)) throw error;\n        lastError = error;\n      }\n    }\n    throw lastError;\n  }\n\n  /** Delete the tenant's credential at exactly that scope. True when a row was removed. */\n  async removeCredential(tenant: CredentialTenant, provider: string): Promise<boolean> {\n    const deleted = await this.#db.deleteMany('model_provider_credentials', tenantWhere(tenant, provider));\n    return deleted > 0;\n  }\n\n  /** All credentials visible to a user: their own rows plus the org's shared rows. */\n  async listCredentials(orgId: string, userId: string): Promise<CredentialRecord[]> {\n    // SQL `IN` never matches NULL, so the org rows need their own query.\n    const [userRows, orgRows] = await Promise.all([\n      this.#db.findMany<CredentialDbRow>('model_provider_credentials', { org_id: orgId, user_id: userId }),\n      this.#db.findMany<CredentialDbRow>('model_provider_credentials', { org_id: orgId, user_id: null }),\n    ]);\n    return [\n      ...userRows.map(row => ({\n        provider: row.provider,\n        scope: 'user' as const,\n        credential: row.data,\n        updatedAt: row.updated_at,\n      })),\n      ...orgRows.map(row => ({\n        provider: row.provider,\n        scope: 'org' as const,\n        credential: row.data,\n        updatedAt: row.updated_at,\n      })),\n    ];\n  }\n\n  /**\n   * Resolve the credential a caller should use for a provider: the user's own\n   * row wins over the org's shared row.\n   */\n  async resolveCredential(orgId: string, userId: string, provider: string): Promise<ResolvedCredential | undefined> {\n    const userRow = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', {\n      org_id: orgId,\n      provider,\n      user_id: userId,\n    });\n    if (userRow) return { provider: userRow.provider, scope: 'user', credential: userRow.data };\n    const orgRow = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', {\n      org_id: orgId,\n      provider,\n      user_id: null,\n    });\n    if (orgRow) return { provider: orgRow.provider, scope: 'org', credential: orgRow.data };\n    return undefined;\n  }\n\n  /**\n   * Refresh the tenant's OAuth credential under the backend's atomic\n   * read-modify-write so concurrent replicas don't invalidate each other's\n   * rotating refresh tokens. The expiry is re-checked under the lock —\n   * another replica may have refreshed already, in which case `refreshFn` is\n   * skipped and the fresh credential is returned. Returns `undefined` when no\n   * OAuth row exists for the tenant.\n   */\n  async refreshOAuth(\n    tenant: CredentialTenant,\n    provider: string,\n    refreshFn: (current: OAuthCredential) => Promise<OAuthCredential>,\n  ): Promise<OAuthCredential | undefined> {\n    let result: OAuthCredential | undefined;\n    await this.#db.updateAtomic<CredentialDbRow>(\n      'model_provider_credentials',\n      tenantWhere(tenant, provider),\n      async row => {\n        if (row.data.type !== 'oauth') return null;\n        const current = row.data;\n        // Re-check under the lock: another replica may have refreshed while we waited.\n        if (!isOAuthCredentialExpired(current)) {\n          result = current;\n          return null;\n        }\n        const next = await refreshFn(current);\n        result = next;\n        return { data: next, updated_at: new Date() };\n      },\n    );\n    return result;\n  }\n\n  /** Persist a pending login flow started by a web route. */\n  async createLoginSession(input: CreateLoginSessionInput): Promise<LoginSessionRow> {\n    const inserted = await this.#db.insertOne<LoginSessionDbRow>('oauth_login_sessions', {\n      session_id: input.sessionId,\n      org_id: input.orgId,\n      user_id: input.userId,\n      provider: input.provider,\n      kind: input.kind,\n      pending: input.pending,\n      expires_at: input.expiresAt,\n      next_poll_at: input.nextPollAt ?? null,\n      created_at: new Date(),\n    });\n    return toSessionRow(inserted);\n  }\n\n  /**\n   * Read a pending login flow. An expired session is deleted on read (TTL\n   * cleanup) and reported as absent.\n   */\n  async getLoginSession(sessionId: string): Promise<LoginSessionRow | undefined> {\n    const row = await this.#db.findOne<LoginSessionDbRow>('oauth_login_sessions', { session_id: sessionId });\n    if (!row) return undefined;\n    if (row.expires_at.getTime() <= Date.now()) {\n      await this.#db.deleteMany('oauth_login_sessions', { session_id: sessionId });\n      return undefined;\n    }\n    return toSessionRow(row);\n  }\n\n  /**\n   * Atomically claim a due login session for one upstream completion/poll attempt.\n   * Returns undefined when the session is missing, expired, owned by another\n   * tenant/provider, or already claimed by a concurrent request.\n   */\n  async claimLoginSession(\n    sessionId: string,\n    owner: Pick<LoginSessionRow, 'orgId' | 'userId' | 'provider' | 'kind'>,\n  ): Promise<LoginSessionRow | undefined> {\n    const now = Date.now();\n    let claimed = false;\n    const updated = await this.#db.updateAtomic<LoginSessionDbRow>(\n      'oauth_login_sessions',\n      { session_id: sessionId },\n      row => {\n        if (\n          row.org_id !== owner.orgId ||\n          row.user_id !== owner.userId ||\n          row.provider !== owner.provider ||\n          row.kind !== owner.kind\n        ) {\n          return null;\n        }\n        if (row.expires_at.getTime() <= now) return null;\n        if (row.next_poll_at && row.next_poll_at.getTime() > now) return null;\n        claimed = true;\n        // Park the next poll at expiry so a concurrent claim loses until the\n        // claimer either touches the session forward or deletes it.\n        return { next_poll_at: row.expires_at };\n      },\n    );\n    return claimed && updated ? toSessionRow(updated) : undefined;\n  }\n\n  /** Update a pending flow's serialized state and/or next allowed poll time. */\n  async touchLoginSession(\n    sessionId: string,\n    updates: { pending?: Record<string, unknown>; nextPollAt?: Date | null },\n  ): Promise<void> {\n    const set: Record<string, unknown> = {};\n    if (updates.pending !== undefined) set.pending = updates.pending;\n    if (updates.nextPollAt !== undefined) set.next_poll_at = updates.nextPollAt;\n    if (Object.keys(set).length === 0) return;\n    await this.#db.updateMany('oauth_login_sessions', { session_id: sessionId }, set);\n  }\n\n  /** Remove a pending login flow (completed, cancelled, or failed). */\n  async deleteLoginSession(sessionId: string): Promise<void> {\n    await this.#db.deleteMany('oauth_login_sessions', { session_id: sessionId });\n  }\n}\n","/**\n * Per-request model-provider credential context.\n *\n * The provider config/OAuth routes serve two deployment shapes:\n *\n * - **Local** (no web auth adapter): credentials live in the server-global\n *   file-backed `AuthStorage` (`auth.json`) — unchanged TUI behavior.\n * - **Tenant** (auth adapter active): credentials live in the\n *   `model-credentials` factory storage domain, scoped per `(orgId, userId)`\n *   with optional org-wide rows (`userId` absent).\n *\n * `resolveCredentialContext` decides which shape a request is in: an\n * authenticated user always gets the tenant path; an unauthenticated request\n * is rejected when auth is enabled and falls back to local otherwise.\n */\n\nimport type { Context } from 'hono';\n\nimport type {\n  CredentialRecord,\n  LoginSessionKind,\n  ModelCredentialsStorage,\n} from '../storage/domains/credentials/base.js';\nimport type { RouteAuth } from './route.js';\n\n/**\n * OAuth credentials are stored under the auth provider id, which differs from\n * the catalog provider id for OpenAI (stored as `openai-codex`). Tenant rows\n * use the same keying so one lookup serves both OAuth tokens and API keys.\n */\nexport function getAuthProviderId(provider: string): string {\n  return provider === 'openai' ? 'openai-codex' : provider;\n}\n\n/**\n * Providers that support a browser-driven OAuth sign-in flow, keyed by\n * *catalog* provider id (what the routes and settings UI use). All flows need\n * no inbound connection to the server: Anthropic uses paste-code PKCE, the\n * rest use RFC 8628-style device codes.\n */\nexport const WEB_OAUTH_FLOW_KINDS: Readonly<Record<string, LoginSessionKind>> = {\n  anthropic: 'paste-code',\n  openai: 'device-code',\n  'github-copilot': 'device-code',\n  xai: 'device-code',\n};\n\nexport type CredentialContext =\n  { mode: 'local' } | { mode: 'tenant'; storage: ModelCredentialsStorage; orgId: string; userId: string };\n\n/**\n * The tenant credentials domain, when registered and ready. `undefined` means\n * the factory never ran (no handle threaded in) or the domain's init failed\n * (fail-soft — callers report the feature unavailable instead of crashing).\n */\nexport async function getTenantCredentialsStorage(\n  credentials: ModelCredentialsStorage | undefined,\n): Promise<ModelCredentialsStorage | undefined> {\n  if (!credentials) return undefined;\n  try {\n    await credentials.ensureReady();\n  } catch {\n    return undefined;\n  }\n  return credentials;\n}\n\n/**\n * Org key for tenant rows. Personal accounts get an org bootstrapped by the\n * auth adapter (`ensureOrg`); if one still isn't present, scope rows under a\n * per-user synthetic org so credentials never become server-global.\n */\nexport function tenantOrgId(tenant: { orgId?: string; userId: string }): string {\n  return tenant.orgId ?? `user:${tenant.userId}`;\n}\n\n/**\n * Resolve the credential context for a request, or a ready-to-return error\n * response. Mutating credential routes call this and hard-fail (401/503)\n * when the tenant path is required but unavailable.\n */\nexport async function resolveCredentialContext({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) {\n    // When an auth provider is active, credential operations always require a\n    // signed-in caller — otherwise one anonymous request could write keys for\n    // everyone. Without a provider this is a single-user local server.\n    if (auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n    return { mode: 'local' };\n  }\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) {\n    return {\n      response: c.json(\n        {\n          error: 'credentials_unavailable',\n          message: 'Tenant credential storage is unavailable — the app database is not configured or failed to start.',\n        },\n        503,\n      ),\n    };\n  }\n  return { mode: 'tenant', storage, orgId: tenantOrgId(tenant), userId: tenant.userId };\n}\n\n/**\n * List the caller's tenant credential records for provider listing, or\n * `undefined` in local mode (caller should fall back to `AuthStorage`).\n * Read-only and degradation-friendly: an authenticated caller with the domain\n * unavailable gets an empty list (sources show `env`/`none`) instead of a 503\n * so the settings page still renders.\n */\nexport async function listTenantCredentialsForRequest({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialRecord[] | undefined> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return auth.enabled() ? [] : undefined;\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) return [];\n  return storage.listCredentials(tenantOrgId(tenant), tenant.userId);\n}\n"],"mappings":";AAmBA,SAAS,kCAAkC;AAC3C,SAAS,wBAAwB;;;ACMjC,SAAS,sBAAsB,4BAA4B;AAyDpD,SAAS,yBAAyB,YAA6B,MAAM,KAAK,IAAI,GAAY;AAC/F,SAAO,OAAO,WAAW;AAC3B;;;AC9BA,eAAsB,4BACpB,aAC8C;AAC9C,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI;AACF,UAAM,YAAY,YAAY;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOO,SAAS,YAAY,QAAoD;AAC9E,SAAO,OAAO,SAAS,QAAQ,OAAO,MAAM;AAC9C;;;AF5CA,IAAM,kBAAkB;AAGxB,IAAM,qBAAqB;AAEpB,IAAM,wBAAN,MAAuD;AAAA,EACnD,2BAA2B;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACT,YAAY,oBAAI,IAA4B;AAAA,EAC5C,aAAa;AAAA,EACb;AAAA,EAEA,YAAY,OAAe,QAAgB,aAAkD;AAC3F,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,eAAe;AAAA,EACtB;AAAA;AAAA,EAGA,MAAM,YAAY,MAAM,KAAK,IAAI,GAAkB;AACjD,QAAI,MAAM,KAAK,aAAa,gBAAiB;AAC7C,SAAK,eAAe,KAAK,SAAS,EAAE,QAAQ,MAAM;AAChD,WAAK,aAAa;AAAA,IACpB,CAAC;AACD,UAAM,KAAK;AAAA,EACb;AAAA,EAEA,MAAM,WAA0B;AAC9B,UAAM,UAAU,MAAM,4BAA4B,KAAK,YAAY;AACnE,QAAI,CAAC,QAAS;AACd,UAAM,UAAU,MAAM,QAAQ,gBAAgB,KAAK,QAAQ,KAAK,OAAO;AACvE,UAAM,OAAO,oBAAI,IAA4B;AAE7C,eAAW,UAAU,QAAQ,OAAO,OAAK,EAAE,UAAU,KAAK,GAAG;AAC3D,WAAK,IAAI,OAAO,UAAU,OAAO,UAAU;AAAA,IAC7C;AACA,eAAW,UAAU,QAAQ,OAAO,OAAK,EAAE,UAAU,MAAM,GAAG;AAC5D,WAAK,IAAI,OAAO,UAAU,OAAO,UAAU;AAAA,IAC7C;AACA,SAAK,YAAY;AACjB,SAAK,aAAa,KAAK,IAAI;AAAA,EAC7B;AAAA;AAAA,EAGA,SAAe;AACb,QAAI,KAAK,IAAI,IAAI,KAAK,cAAc,iBAAiB;AACnD,WAAK,KAAK,YAAY,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACxC;AAAA,EACF;AAAA,EAEA,IAAI,UAA8C;AAChD,WAAO,KAAK,UAAU,IAAI,QAAQ;AAAA,EACpC;AAAA,EAEA,gBAAgB,UAAsC;AACpD,UAAM,OAAO,KAAK,UAAU,IAAI,QAAQ;AACxC,WAAO,MAAM,SAAS,YAAY,KAAK,MAAM;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,UAAU,UAA+C;AAC7D,UAAM,UAAU,MAAM,4BAA4B,KAAK,YAAY;AACnE,QAAI,CAAC,SAAS;AAGZ,YAAM,OAAO,KAAK,UAAU,IAAI,QAAQ;AACxC,UAAI,MAAM,SAAS,UAAW,QAAO,KAAK;AAC1C,UAAI,MAAM,SAAS,WAAW,CAAC,yBAAyB,IAAI,GAAG;AAC7D,eAAO,iBAAiB,QAAQ,GAAG,UAAU,IAAI;AAAA,MACnD;AACA,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,MAAM,QAAQ,kBAAkB,KAAK,QAAQ,KAAK,SAAS,QAAQ;AACpF,QAAI,CAAC,UAAU;AACb,WAAK,UAAU,OAAO,QAAQ;AAC9B,aAAO;AAAA,IACT;AACA,SAAK,UAAU,IAAI,UAAU,SAAS,UAAU;AAEhD,QAAI,SAAS,WAAW,SAAS,WAAW;AAC1C,aAAO,SAAS,WAAW;AAAA,IAC7B;AAEA,UAAM,gBAAgB,iBAAiB,QAAQ;AAC/C,QAAI,CAAC,cAAe,QAAO;AAE3B,QAAI,CAAC,yBAAyB,SAAS,UAAU,GAAG;AAClD,aAAO,cAAc,UAAU,SAAS,UAAU;AAAA,IACpD;AAIA,UAAM,YAAY,SAAS,UAAU,SAAS,EAAE,OAAO,KAAK,QAAQ,QAAQ,KAAK,QAAQ,IAAI,EAAE,OAAO,KAAK,OAAO;AAClH,QAAI;AACF,YAAM,YAAY,MAAM,QAAQ,aAAa,WAAW,UAAU,OAAM,aAAY;AAAA,QAClF,MAAM;AAAA,QACN,GAAI,MAAM,cAAc,aAAa,OAAO;AAAA,MAC9C,EAAE;AACF,UAAI,CAAC,UAAW,QAAO;AACvB,WAAK,UAAU,IAAI,UAAU,SAAS;AACtC,aAAO,cAAc,UAAU,SAAS;AAAA,IAC1C,QAAQ;AAEN,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,IAAM,eAAe,oBAAI,IAAmC;AAE5D,SAAS,SAAS,QAA6B,aAA6D;AAC1G,QAAM,QAAQ,YAAY,MAAM;AAChC,QAAM,MAAM,GAAG,KAAK,KAAS,OAAO,MAAM;AAC1C,MAAI,QAAQ,aAAa,IAAI,GAAG;AAChC,MAAI,CAAC,OAAO;AACV,QAAI,aAAa,QAAQ,oBAAoB;AAC3C,YAAM,SAAS,aAAa,KAAK,EAAE,KAAK,EAAE;AAC1C,UAAI,WAAW,OAAW,cAAa,OAAO,MAAM;AAAA,IACtD;AACA,YAAQ,IAAI,sBAAsB,OAAO,OAAO,QAAQ,WAAW;AACnE,iBAAa,IAAI,KAAK,KAAK;AAAA,EAC7B;AACA,SAAO;AACT;AAQO,SAAS,iCAAiC,aAA4C;AAC3F,6BAA2B,YAAU,SAAS,QAAQ,WAAW,CAAC;AACpE;AAGO,SAAS,wCAA8C;AAC5D,6BAA2B,MAAS;AACpC,eAAa,MAAM;AACrB;AAQO,SAAS,oCAAoC,QAAkD;AACpG,MAAI,OAAO,QAAQ;AACjB,iBAAa,OAAO,GAAG,OAAO,KAAK,KAAS,OAAO,MAAM,EAAE;AAC3D;AAAA,EACF;AACA,aAAW,OAAO,aAAa,KAAK,GAAG;AACrC,QAAI,IAAI,WAAW,GAAG,OAAO,KAAK,IAAQ,EAAG,cAAa,OAAO,GAAG;AAAA,EACtE;AACF;AAQA,eAAsB,uBAAuB;AAAA,EAC3C;AAAA,EACA;AACF,GAGkB;AAChB,QAAM,SAAS,QAAQ,WAAW,EAAE,YAAY;AAClD;AAEO,SAAS,6BAA6B;AAAA,EAC3C;AAAA,EACA;AACF,GAGsB;AACpB,SAAO,OAAO,GAAG,SAAS;AACxB,UAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,QAAI,QAAQ;AACV,UAAI;AACF,cAAM,SAAS,QAAQ,WAAW,EAAE,YAAY;AAAA,MAClD,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,KAAK;AAAA,EACb;AACF;","names":[]}

package/dist/routes/work-items.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Mastra `apiRoutes` for Factory work items (the kanban board).
+ *
+ * Registered alongside the other `/web/*` routes behind the host auth gate.
+ * The board is org-wide: every route re-resolves the caller's `(orgId, userId)`
+ * tenant and scopes reads/writes by `orgId`, so any org member sees and moves
+ * the same cards while `created_by` / stage history record who acted.
+ */
+import type { ApiRoute } from '@mastra/core/server';
+import type { FactoryStartCoordinator } from '../rules/start-coordinator.js';
+import type { FactoryTransitionService } from '../rules/transition-service.js';
+import type { AuditEmitter } from '../storage/domains/audit/domain.js';
+import type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';
+import type { QueueHealthStorage } from '../storage/domains/queue-health/base.js';
+import type { CreateWorkItemInput, UpdateWorkItemInput, WorkItemsStorage } from '../storage/domains/work-items/base.js';
+import type { RouteDependencies } from './route.js';
+import { Route } from './route.js';
+export interface WorkItemRoutesDeps extends RouteDependencies {
+    audit: AuditEmitter;
+    /** Factory projects domain — validates the `:id` project belongs to the caller's org. */
+    projects: FactoryProjectsStorage;
+    /** Work-items domain backing the kanban board. */
+    workItems: WorkItemsStorage;
+    /** Per-project queue-health threshold config. */
+    queueHealth: QueueHealthStorage;
+    /** Governed stage-transition service. Stage moves 503 when absent. */
+    transitionService?: Pick<FactoryTransitionService, 'transition' | 'ruleSetVersion'>;
+    /** Coordinator that binds a Factory run before dispatching its kickoff. */
+    startCoordinator?: Pick<FactoryStartCoordinator, 'prepare'>;
+}
+/** Validate an untrusted create body. Unknown keys are dropped. */
+export declare function parseCreateWorkItem(body: unknown): CreateWorkItemInput | null;
+/** Validate an untrusted patch body. Unknown keys are dropped. */
+export declare function parseUpdateWorkItem(body: unknown): UpdateWorkItemInput | null;
+export declare class WorkItemRoutes extends Route<WorkItemRoutesDeps> {
+    #private;
+    /** Build the Factory work-item routes as Mastra `apiRoutes`. */
+    routes(): ApiRoute[];
+}
+//# sourceMappingURL=work-items.d.ts.map

package/dist/routes/work-items.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-items.d.ts","sourceRoot":"","sources":["../../src/routes/work-items.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,KAAK,EACV,uBAAuB,EAGxB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAA4B,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAGzG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAElF,OAAO,KAAK,EACV,mBAAmB,EAInB,mBAAmB,EAKnB,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAG/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,KAAK,EAAE,YAAY,CAAC;IACpB,yFAAyF;IACzF,QAAQ,EAAE,sBAAsB,CAAC;IACjC,kDAAkD;IAClD,SAAS,EAAE,gBAAgB,CAAC;IAC5B,iDAAiD;IACjD,WAAW,EAAE,kBAAkB,CAAC;IAChC,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,GAAG,gBAAgB,CAAC,CAAC;IACpF,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;CAC7D;AAqED,mEAAmE;AACnE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAuB7E;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CA4B7E;AAmLD,qBAAa,cAAe,SAAQ,KAAK,CAAC,kBAAkB,CAAC;;IAwG3D,gEAAgE;IAChE,MAAM,IAAI,QAAQ,EAAE;CAsWrB"}